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Abstract 

The Tardos scheme is a well-known traitor tracing scheme to 
protect copyrighted content against collusion attacks. The orig- 
inal scheme contained some suboptimal design choices, such as 
the score function and the distribution function used for gener- 
ating the biases. Skoric et al. previously showed that a symbol- 
symmetric score function leads to shorter codes, while Nuida 
et al. obtained the optimal distribution functions for arbitrary 
coalition sizes. Later, Nuida et al. showed that combining these 
results leads to even shorter codes when the coalition size is 
small. We extend their analysis to the case of large coalitions 
and prove that these optimal distributions converge to the arc- 
sine distribution, thus showing that the arcsine distribution is 
asymptotically optimal in the symmetric Tardos scheme. We 
also present a new, practical alternative to the discrete distri- 
butions of Nuida et al. and give a comparison of the estimated 
lengths of the fingerprinting codes for each of these distribu- 
tions. 



1 Introduction 

To fight against copyright infringement, distributors of copy- 
righted content embed hidden watermarks in the data, creating 
a different version of the content for each user. Then, when 
a user distributes his copy and the distributor finds it, the dis- 
tributor extracts the watermark from this copy and traces it to 
the guilty user Assuming two versions can be created for ev- 
ery segment of the content, it is clear that with a binary search, 
i ~ log2 n watermarked content segments suffice to find one pi- 
rate hidden among n users. 

Things become more complicated when several users col- 
lude, and compare their differently watermarked copies to cre- 
ate a new version of the content that does not exactly match 
any of their copies. Assuming that for each segment of the data 
there are two different versions, and that in each segment the 
colluders output one of their received versions (known in the 
literature as the marking assumption), it is impossible to trace 
c > 2 colluders deterministically (i.e., with no probability of 
error) with any fixed amount of segments. Fortunately, proba- 
bilistic schemes do exist that allow us to trace up to c colluders 
with at most e probability of error, for any given c > 2 and 
e > 0. One of the main objectives of research in this area is 
to construct such traitor tracing schemes, that allow us to trace 
colluders with as few segments £ as possible. 



1.1 Related work 



In 2003, Tardos p3| showed that the optimal length of such 
codes (i.e., the number of segments needed) is of the order i = 
d(C^ln{n/ei) with dc — where Ci is an upper bound on 

the probability of catching one or more innocent usersj^ In the 
same paper, Tardos gave a construction of a scheme with di = 
100, which is widely known as the Tardos scheme. This shows 
that d(' = is optimal, and that the Tardos scheme has the 
optimal order code length. 

Over the last ten years, improvements to the Tardos scheme 
have lead to a significant decrease in the code length parame- 
ter d(. We previously showed f6l| that combining the symbol- 
symmetric score function of Skoric et al. [11] with the improved 
analysis of Blayer and Tassa [3] leads to an asymptotic code 
length constant of d( — jTi^ ^ 4.93 for large c. For small coali- 
tions, Nuida et al. |9 1 showed that even smaller values d( can be 
obtained by combining the symmetric score function with the 
optimized, discrete distribution functions previously obtained 
by Nuida et al. 1 10|. For large c, this lead to an asymptotic code 
length constant of about dg « 5.35. 

Besides practical constructions of traitor tracing schemes, 
some papers have also studied absolute lower bounds on the 
asymptotic code lengths that any secure traitor tracing scheme 
must satisfy. Huang and Moulin |4| and Amiri and Tardos Q 
showed that for large c, the code length constant of any scheme 
must satisfy d( > 2, but no practical constructions of schemes 
achieving this lower bound are known. Huang and Moulin did 
show that this lower bound is tight, and that in the related min- 
max game between the traitors and the tracer, the optimal pirate 
strategy is to use the interleaving attack, and the optimal trac- 
ing strategy is to use a Tardos-like code with biases distributed 
according to the arcsine distribution. Note that this does not say 
anything about specific schemes such as the Tardos scheme, for 
which the related min-max games are different and may lead to 
a completely different optimal pirate strategy and tracing strat- 
egy- 

1.2 Contributions and outline 

In this paper, we show that for large coalition sizes, the discrete 



distributions of Nuida et al. |9|10) converge to the arcsine distri- 
bution, thus proving that in the symmetric Tardos scheme, the 
arcsine distribution is asymptotically optimal. Together with 
results of Skoric et al. |l l| and us |6|, this further implies that 
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the asymptotic code length £ ~ j Tt-^c^ ln(n /ei ) is optimal in the 
symmetric Tardos scheme. On the practical side, we present an 
alternative to the distributions of Nuida et al. with a simpler bias 



Note that £2, commonly used for an upper bound on the probability of not 
catching any pirates, does not appear in the leading term of the code length for 
most practical values of £[ and 62 . 
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generation method, and conjecture that its performance is close 
to the performance of the distributions of Nuida et al. 

The outHne of this paper is as follows. In Section |2] we de- 
scribe the symmetric Tardos scheme, and different choices for 
the distribution function F used in this scheme. In Section|3]we 
state our results, and we devote Section]?] to proving the main 
result. In Section|5]we present what we call discrete arcsine dis- 
tributions, and in Section ]6] we give a heuristic comparison of 
the lengths of the codes in the symmetric Tardos scheme when 
using these various distribution functions. Finally, in Section |7] 
we briefly discuss the results and mention a direction for future 
research. 



2 The symmetric Tardos scheme 

Before we describe the Tardos scheme, we introduce some more 
notation. The matrix X = {^j.i), consisting of bits, is used to 
indicate which of the two versions of the ;th content segment is 
assigned to user j, for each user y G { 1 , . . . , n} and each segment 
/ e { 1 , . . . , ^}. We write y — (y,) for the pirate output, consisting 
of £ bits. 

The Tardos scheme roughly consists of two parts, which are 
outlined below. The scheme depends on appropriately chosen 
functions F and g, and constants I and Z. The first part of the 
scheme is performed before the content is distributed, and fo- 
cuses on generating the code matrix X. The second part is per- 
formed once the pirates have output a forged copy y and this 
copy has been detected by the distributor, and focuses on find- 
ing the guilty users. 

(1) Codeword generation 

- For each /, generate p, ^ F. 

- For each generate Xjj ^ Bernoulli (/j,). 

(2) Accusation algorithm 

- For each compute Sjj ^ g{Xjj,yi,pi). 

- For each j, accuse user j iiYi=i Sjj > Z. 

This description is very general, and covers (almost) any 
known version of the Tardos scheme. The choice of F and g, 
and the method to determine i and Z, are what separates one 
scheme from another. In this paper we will focus on the class 
of symmetric Tardos schemes, which means choosing g as the 
symbol-symmetric score function of Skoric et al. |11 1: 



8iXj,i,yi,Pi) = 



'+^{^-p,)/Pi. if^,v = l,3', = l, 
ifX,v = l,3',=0, 
-V/VCI-pO, if^,v-0,3', = l, 
+ ^Pi/{^-Pi). ifX,i = 0,3',=0. 



In this paper we will not go into detail about choosing £ and Z, 
but focus on the distribution function F. 

2.1 Continuous arcsine distributions 

A common choice for the distribution function F is the arcsine 
distribution with appropriate cutoffs. More precisely, we first 
compute a cutoff parameter 5c > 0, and we then use the distri- 
bution function Fc defined on [8c, 1 — 5c] by: 



Fcip) 



2 arcsin — 2 arcsin 
TT — 4arcsin\/S^ 



{8c<P<l-dc) 



For c = 10, the distribution function Fiq is shown in Figure [T] 
For small values of c, the parameter 5c has to be sufficiently 
large for a certain proof of security to work. For large c, the 
cutoff 5c tends to 0, and the distributions converge to the well- 
known arcsine distribution Fo^, defined on [0, 1] by: 



Fo<,{p) — — arcsin -V/?. 
7t 



iO<P<l) 



With these continuous arcsine distribution functions, we pre- 
viously showed |6| that an asymptotic code length constant of 
di ~ 4.93 is optimal. For details, see 



2.2 Discrete Gauss-Legendre distributions 



Nuida et al. |]9]]T0| showed that if the pirates aim to mini- 
mize their expected total score, the optimal distributions are 
in fact discrete distributions, and are related to Gauss-Legendre 
quadratures in numerical analysis. To define these distributions, 
we first need to introduce Legendre polynomials. For c > 1, the 
cth Legendre polynomial is given by 



This polynomial has c simple roots on (—1,1), which we will 
denote by x\^c < X2,c < ■ ■ ■ < Xc^c- Now, the optimal distribution 
functions, for arbitrary c, are as follows. Here, optimal means 
that these distribution functions maximize the expected coali- 
tion score. 



Lenuna 1. ^70) Theorem 3 ] The optimal distribution to fight 
against 2c — I or 2c colluders, is 

F2c-l{p)=F2cip) = ^t ^k.cHip-pk.c), iO<p<l) 

k=l 

where Nc is a normalizing constant, H is the Heaviside step 
function, and the points pk,c and weights Wk,c ore given by 



Pk.i 



Xk.c + 1 



2 ■ 



The Gauss-Legendre distribution designed to resist 10 col- 
luders is shown in Figure]!] For small c, this construction gives 
much shorter codes than those obtained using the arcsine dis- 
tributions with cutoffs. For large c, the code length parame- 
ter goes up, and Nuida et al. |9| show that their results can be 
extended to a construction that asymptotically achieves a code 
length constant of the order d( ^ K Ri 5.35. For details on this 
asymptotic result and Lemma [T] we refer the reader to |]9j]T0). 

2.3 The asymptotic optimum 

As we discussed above, the asymptotic code length constant 
obtained by Nuida et al. I^J is slightly higher than the one ob- 
tained by us |]6|. This means that the asymptotic result of Nuida 
et al. is not optimal. On the other hand, due to the Central Limit 
Theorem, the scores of innocent users (per segment) converge 
to the standard normal distribution with mean and variance 1, 
while the total score of the coalition (per segment) converges to 
a normal distribution with some unknown mean p. and variance 
&^ < °°, depending on the choice of F and the pirate strategy. 
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- continuous (c = 10) 

- arcsine distribution 

- discrete F^ (c = 10) 



1.0 



Figure 1: The continuous arcsine distribution function with cutoff 5io ~ 0.003 
(red) and the discrete Gauss-Legendre distribution function (green), both cor- 
responding to the case c = 10. The dashed curve shows the arcsine distribution 
function. 



For fixed £2 > and large c, the only parameter that influences 
the asymptotic code length is the mean p., which is minimized 
by Nuida et al.'s choice of distribution functions. So we do 
expect that the asymptotic lengths of the codes in the symmet- 
ric Tardos scheme are minimized when using the distribution 
functions of Nuida et al. The fact that their asymptotic con- 
stant d( « 5.35 is higher than the constant de ~ 4.93 which we 
showed to be sufficient for large c f6l, suggests that Nuida et 
al.'s asymptotic analysis was not tight. Up until now, it was thus 
an open question what the best asymptotic distribution func- 
tions are in the symmetric Tardos scheme, as well as what their 
accompanying code length constants are. 

3 Main results 

We will prove that letting c tend to infinity in the class of dis- 
crete distributions of Nuida et al. leads exactly to the arcsine 
distribution. This will be done by proving the following main 
result. 

Theorem 1. Let the parameters pk.c, wt.c ond Nc as in 
Lemma^ Let a > 0, and let k satisfy ac <k < (1 — a)c. Tlien, 



PLc = &in^ { +0(1), 



7Z fl 

-+o[- 
c \ c 



Nc = K-o{l) 



(1) 

(2) 
(3) 



Note that except for the points near and 1, corresponding 
to A: = o(c) 01 k ~ c — o{c), the leading terms of the weights are 
all equal. But since these points in the 'middle' carry 1 — o(l) 
weight (cf. the proof of (|3]l), the points near and 1 have a 
negligible total weight. On the other hand, the points pi^ c con- 
verge to the expected values of the corresponding order statis- 
tics of the arcsine distribution, i.e., the value y corresponding 
to ^00(3;) = Ms exactly y = /C'(^) = sin^i^) = ft^ + o(l). 



Since asymptotically all these points have the same weight, 
after k of the c points we also have F2c(p['^'') — ^ or 
■^2c'(e) ~ Pk,c + o{l). Since the set of points {pk,c}l=i is 
dense in (0, 1) when c tends to infinity, these results imply that 
Ficip) — > Fo'ip) for each p e (0, 1), proving that the arcsine 
distribution is asymptotically optimal in the symmetric Tardos 
scheme. 

Theorem 2. In the symmetric Tardos scheme, the arcsine dis- 
tribution is asymptotically optimal. 

Skoric et al. 1 11 , Section 6] previously showed that when 
using the arcsine distribution, due to the Central Limit The- 
orem the optimal code length inevitably converges to £ — >^ 
^n^c^\n{n/ e\). So the following corollary is immediate. 

Corollary 1. In the symmetric Tardos scheme, the following 
code length is asymptotically optimal: 



t= (^y+o(l)jc^ln(n/ei). 

In addition to these theoretical results, we present a new class 
of distribution functions, which can be obtained by discarding 
some of the order terms in Theorem[T] Compared to the Gauss- 
Legendre distributions, these distributions are much simpler, 
but still seem to achieve comparable code lengths. For details, 
see Sections |5] and |6] 

4 Proof of Theorem [H 

([TJ: Let Q]^ c — arccos (xi,,,.). From IT] Eq. (22.16.6)] we have 

/4(c-A:)+3\ nk 
^k.c^[ \^^^ j7r + o(l)^7r- — +0(1). (4) 

Using cos (tt — ) = 2 sin^ ( y ) — 1 for ^ G M, we get 

jc^.,,. = cos ^;r- ^ +0(1)^ =2sin^ - 1 +o(l). 

Since pi^j. = |(jc^,c + 1)^ Equation ([T} follows. 

(p): Combining jfe] Eq. (15.3.1)] and |12, Eq. (15.3.10)], and 

air 

using 2sin(-|^)cos(^) = sin(0i.,t.), we get 



Dividing both sides by y^l — — sinQ/. ^ leads to ([2]l. 
(|3]i: The Gauss-Legendre quadrature rule yj Eq. (25.4.29)] 
states that for analytic functions /, there exist constants Ac > 
and ^ e (-1, 1), with 



Let f{x) = (1 -x2)-i/2. Then we have f^^'^x) > for all 
X e (- 1 , 1 ), so in particular /t^''' ) > 0. So it foUows that 



dx 



-1 Vl ^,^1 



(5) 
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On the other hand, from Q and wj^ c > for all k, we have 



10 



k=o(c) 

So TT — o(l) < Nc < 71, which proves ([3]). 



5 Discrete arcsine distributions 

By making a slight refinement to ([T]i using we get that for 
large c and almost all values of k, the parameters of the optimal 
distributions satisfy 



Pk.c 



4k- I ^ 
8c +4' 



T 
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continuous F^. (provable) 

— continuous F^. (heuristic) 

— - arcsine distribution F^ 

— discrete (arcsine) 

— discrete F^. (optimal) 



50 100 



500 1000 



To get the exact values of these parameters for large c requires 
quite some effort, so in practice one may consider using an ap- 
proximation of these distributions. An obvious approximation 
to the above weights and points would be 



Figure 2: Estimates of the code length parameters df for several types of dis- 
tribution functions F. The dashed line shows the asymptotic optimal value 
dt = in-, corresponding to the arcsine distribution F^. 



4k-l ^ 
8C + 4' 



Generating biases p from the associated distribution func- 
tion is equivalent to drawing r uniformly at random from 
{gif?' g^fl' • • • ' f - slf?}' and setting p = sin2(r). Note that 
if we were to draw r uniformly at random from the complete in- 
terval [0, |], this would correspond to the arcsine distribution, 
while drawing r uniformly at random from [arcsin(\/5), f — 
arcsin(v'5)] corresponds to the arcsine distribution with cutoff 
5. So these distributions may be appropriately called discrete 
arcsine distributions, and needless to say, for large c these dis- 
tributions also converge to the arcsine distribution. 
Remark. Interestingly, slightly different parameters. 



Pk.c = sin 



4k-2 



^k.c 



correspond exactly to the parameters of the so-called Cheby- 
shev-Gauss quadratures [1, Eq. (25.4.38)]. These quadratures 
allow one to approximate integrals of the form 



/ 



{x) 



-.dx ; 



■ Y^w'k.cg{4,c)i 

k=l 



(6) 



where x'l_ ^ 



2 p'[ 1 1^ The distribution functions generated by 
these weights and points are very similar to the discrete arcsine 
distributions described above. The main difference seems to 
be the "cutoff", which would be about a third smaller (i.e., || 
compared to g|q^)- Since these distributions are worse approx- 
imations of the optimal Gauss-Legendre distributions, it seems 
that the discrete arcsine distributions are a better alternative. 



6 Estimating Codelengths 

Let us now try to give a qualitative comparison of the sev- 
eral classes of discrete and continuous distribution functions, in 



^Also note the resemblance between Equations j6| and jsj, when g{x) = 1 
is the constant function with value 1 . 



terms of code lengths. Since the (tails of) distributions of user 
scores are hard to estimate, and known proof methods are not 
tight, we will only give a heuristic estimate of the code lengths. 
Getting more accurate estimates remains an open problem. 

Assuming that the scores of users are Gaussian, we can get 
a reasonable estimate for the optimal code length parameter as 
d( « where fl is the expected average pirate score per 

content segment 1 11 , Corollary 2]. In the case of the discrete 
distributions of Nuida et al., p. does not depend on the pirate 
strategy, so we can compute jl exactly. For the arcsine distribu- 
tions with cutoffs and the discrete arcsine distributions, p. does 
depend on the pirate strategy, but by considering the attack that 
minimizes fi we can obtain lower bounds on p.. 

Figure |2] shows the resulting estimates of d(, as well as the 
provable upper bounds on de of |[6) (for constant £2). Note that 
the heuristic estimates for the continuous distributions are based 
on the arcsine distributions with cutoffs optimized for the proof 
technique of |6|. A different optimization of the cutoffs would 
lead to different (smaller) values of de. 



7 Conclusion 

We have shown that the optimal discrete distributions of Nuida 
et al. converge to the arcsine distribution, hence showing that 
the arcsine distribution is asymptotically optimal in the sym- 
metric Tardos scheme. This connects the world of the discrete 
distributions to the world of the continuous distributions, as 
both converge to the same distribution. 

In practice, the question remains which distribution function 
to choose. In the static Tardos scheme, choosing one of the 
discrete distributions seems logical, as this may drastically re- 
duce the length of the fingerprinting code. On the other hand, 
when c is unknown, using the continuous distribution functions 
with cutoffs may also have its benefits, since if the coalition is 
slightly larger than expected, the scheme still has a good chance 
of catching the pirates. Recently, it was shown that the Tar- 
dos scheme can also be extended to the dynamic traitor tracing 
setting, allowing efficient tracing of pirates when the colluders 
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broadcast their forged copy in real-time 0|8). The construction 
of the universal Tardos scheme in |T| uses the fact that the con- 
tinuous distributions are very similar for different values of c, so 
in this setting it seems that the continuous arcsine distributions 
are also more practical. 

An interesting open problem is what happens when the num- 
ber of versions per content segment increases from 2 to q. Re- 
cent results show |5 1 that with unlimited computing power, the 
optimal asymptotic code length decreases linearly in q. This 
suggests that the optimal length of q-ary Tardos codes possibly 
decreases linearly in q as well. Skoric et al. 1 11 1 analyzed a 
natural generalization of the Tardos scheme to the g'-ary setting, 
but did not obtain this linear decrease in q in their code lengths. 
The question remains whether their construction is suboptimal 
(and if so, whether this has to do with the choice of F or the 
choice of g), or if approaching the fingerprinting capacity for 
higher q with a single decoder traitor tracing scheme is simply 
impossible. 
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